The webRequest permission
An extension holding webRequest can
watch all network traffic from the sites it has access to, including what is sent and received.
We weight it 15 out of 100 when scoring how much an extension can reach. That is a measure of capability, not of behaviour: plenty of extensions need this to do their job.
- Extensions we track using it
- 1,636
- Share of those we have checked
- 2.4%
- Risk weight
- 15/100
What replaced it
Manifest V3 extensions mostly use declarativeNetRequest instead, which blocks and rewrites requests without letting the extension read them. An extension still asking for this one is either on the old platform or has a reason to need the traffic itself.
Who asks for it
Out of the 67,225 extensions we have examined, 1,636 declare this permission. These are the largest of them by user count.
Counts are of extensions we have checked ourselves, not of the whole Chrome Web Store. Chrome's own reference for developers: developer.chrome.com. How we weight permissions